Critical Security Flaw in css-reading-display-polyfill: Malicious Code Execution
Summary
MAL-2026-17656: Malicious code in css-reading-display-polyfill (npm). Affects css-reading-display-polyfill versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
css-reading-display-polyfill is an npm package designed as a CSS polyfill. However, it lacks any actual polyfill functionality and instead contains malicious code that executes upon loading. This code is designed to collect sensitive information from the host environment, making it a significant security risk for developers and organizations using this package.
Vulnerability Detail
The vulnerability originates from the thunderboltRegistry.js file within the css-reading-display-polyfill package. When this file is loaded, it executes a series of commands that gather sensitive information such as the host identity (id, whoami, uname), environment variables, network interfaces, and the contents of /etc/hosts. This information is then sent to a hardcoded external URL (https://webhook.site/69bcd627-1871-4dda-b880-83b37ceac418), potentially exposing tokens, API keys, and other sensitive data. The malicious nature of this code poses a severe risk, particularly in environments where CI secrets and cloud credentials are stored as environment variables.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall css-reading-display-polyfillIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can prevent the execution of the malicious code by avoiding the use of this package altogether. If you must use it, consider isolating it in a controlled environment where sensitive data is not accessible.
Conclusion
The css-reading-display-polyfill package poses a significant security risk due to its embedded malicious code that collects and exfiltrates sensitive information. It is crucial for developers to remove this package and monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying vulnerabilities in your projects.
See every vulnerability recorded for css-reading-display-polyfill →
FAQ
css-reading-display-polyfill is an npm package that was intended to serve as a CSS polyfill but contains malicious code instead.
The malicious code runs commands to collect sensitive information from the host and sends it to an external server.
The code collects host identity, environment variables, network interfaces, and the contents of /etc/hosts.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Remove the css-reading-display-polyfill package from your project immediately and monitor your environment for any potential leaks of sensitive information.
